I have no problem with GPG, and use it with Linux. I've also used PGP since the good old illegal days when it was all command line, and the Feds were still trying to put Phil in jail. The problem with GPG is that it's not going to really get traction until there is a one-shot binary install for Windows that integrates with common programs that people use. While we all know it isn't that tough to install the command line version and then a GUI front end, most users can't/won't do that.

Short version - Phil Zimmerman wrote PGP. PGP incorporated the RSA algorithm. This got the feds after him for violation of the Arms Export Control Act, because strong crypto was considered munitions. Sanity prevailed after about three years and a bunch of lawyers' bills. A slightly longer version is here [wikipedia.org] in the Wikipedia article on PGP.

Let me guess - you're under 25 AND you've only recently discovered that there is technical stuff going on behind the screen of your computer?

You've got your link to the story. While I wasn't particularly bothered one way or another about mail encryption, I did see the potential and understand it both for personal use, and for encrypting client's data while moving it around (as opposed to couriering it with a trusted person, which was the norm for us, then). But could I find a copy of PGP? Could I fsck! (Obv

GPG [gnupg.org] is also reliable, reputable, fast, free, open source, and works on Windows, Mac OS X, and Linux.

What we need is a list of things PGP can do that the free, open source GPG can't do. Is there anything? If GPG can do everything PGP can do, then there is no reason to pay a lot of money for a closed-source alternative.

Symantec will more than likely manage to screw this up just like they screw everything else up. Seriously, once upon a time their virus stuff was good. Now, you've gotta jump through hoops to remove it, their enterprise-level customer service is garbage, so I can only imagine how bad their home user support must be, and at some point their code base for the AV stuff grew so bloated you could run a Toyota (poorly) off it.

Yeah no crap, and not just their AV. Anybody remember when Norton Utilities was actually good? Man those were the days, we wouldn't hardly let a PC out of the shop until they had bought a copy of Norton Utilities. Hell Norton's Disc Doctor was light years better than anything MSFT had for Win9X! Then Symantec bought it and it went from a "must have" to a tool more likely to cause screw ups than to actually fix them. Norton, Partition Magic, man it seems like every decent tool Symantec gets their hands on tu

Ran Corporate version 9, 10 and 11, then with 12 it all fell apart. The replication database should only grow to 5 gigs in size. But it keeps growing till there is no space on the servers hard drive. We had to literally uninstall it, reinstall it, configure it and run it for 3 months till the database filled a 200 gig hard drive. 3 times. After 9 months and a promised "fix" always soon to be released but never actually seeing the light of day, we switched to Kaspersky.

I do not trust Symantec on enterprise anything since the days I was working with their Storage Foundation.

Bad trick #1Go to the training course, where the instructor is bragging how he helped write the product. Observe that occasionally during the training course the software happens to lose sight of your volumes. Ask instructor, "how do I fix this?". Received response, "hmm...format and start again. I don't know how to fix that." If this is a production environment, I've just lost terabytes of critical inf

Here's where we get into the point of "professional tool" vs. "something I install on my home PC". For professional people, the cost of software like Photoshop, VS.Net, Final Cut Pro, and others is almost completely insignificant. Compared to all the other costs of doing business, it's almost crazy not to pay for it. However for the home user, or hobbyist, these products seem completely out of range with what you get out of them. When you pay $300 for a computer, even $50 on a windows license, or $50 for

Here's where we get into the point of "professional tool" vs. "something I install on my home PC".

The GP was talking about software for his job. So no, your point has nothing to do with the topic.

For professional people, the cost of software like Photoshop, VS.Net, Final Cut Pro, and others is almost completely insignificant. Compared to all the other costs of doing business, it's almost crazy not to pay for it. However for the home user, or hobbyist, these products seem completely out of range with what you get out of them.

Which is why professional graphic design have all dumped Photoshop for Duh GIMP? And all those people who work in professional video arena have dumped all their proprietary tools for KDenlive?

GIMP started as a toy project. It's much better now, but would certainly profit from a major redesign (and I'm *not* talking about UI here). As far as video editing is concerned, what about Lightworks?:)

You shouldn't be using PGP for email encryption anyways. S/MIME is built into almost all modern email clients. The real reason that email encryption has not caught on is that it is basically impossible to implement it in webmail clients. (although signing is still possible).

It absolutely does not. Those are handy places to find new keys, but it's perfectly possible for someone to simply send you their public key as part of the first exchange, and then do whatever sort of out-of-band validation you'd do with a key you found in the keyserver.

If I want top notch security and not trusting some firm (possibly a CA that is offshore and is hostile to anything the country I reside in anyway), I will be using a PGP/gpg web of trust. I will either get a copy of the public key of someone face to face printed physically with a fingerprint (and will download and verify the public key and has from a keyserver), or I will agree on a passphrase that is used only once, and that is to send and receive a copy of the public key.

I also don't like keeping my public key that would be needed for S/MIME on an online machine. My secure private key resides on a machine that isn't Internet connected, it will reside on a smart card, or it will be on a smart card and used on an offline machine, so an attack would have to be done on a physical/local level in order to compromise my private key material. I do use S/MIME and a client key, but that is mainly a stopgap, better than nothing measure, compared to actual end to end manual encryption of data with gpg or PGP.

PGP WOTs were in use a lot in the early to mid 1990s by cypherpunks, but for the most part, convenience won over security and it is extremely rare for someone to use a public key of someone to send mail. A good WOT is far better than a CA. I have more trust in a public key claimed to be someone that is 3-4 links out from me on my PGP/gpg keyring than I do a key that is signed by a CA and told "hey, trust us." Of course, creating a WOT is a lot harder than just letting a CA do the work, but like Phil Zimmermann said, it is better to pack your own parachute when security is critical.

Another use for PGP over S/MIME is signing of files. A signed E-mail is difficult to forward and keep the integrity intact. However, if I have a file and a PGP/gpg signature of it (or just a PGP signed file), I can forward it, archive the two files, back them up to whatever backup media, and all it takes is a validation in the future to ensure that the file and the signature were not tampered with, assuming I have the public key in my keyring, and that hasn't been tampered with. Of course, I can use facilities like the file signing capabilities built into Acrobat, Word, or other software, but again, I have to use a third party CA, or pay for a special signing key, as opposed to a secure WOT. Plus, some files (archives and such) can't be signed internally, so having a separate.sig file is needed.

S/MIME is decent, built into most dedicated E-mail clients, and is better than nothing. However, if you want reliable E-mail security, you are best off using a PGP/gpg WOT.

Arg... this is so painful to read. What is with the mods? +1 Long post?

If I want top notch security and not trusting some firm (possibly a CA that is offshore and is hostile to anything the country I reside in anyway), I will be using a PGP/gpg web of trust.

I'm not a big defender of the big CAs, but trust chains serve a purpose. In a WOT, who first decides that someone really is associated with a given name, and why on Earth do you trust _them_? Sure, you will all be talking to the same person, but who is that? The point of the chain model is that at least someone is responsible for verifying a certificate holder's identity in some minimal way. To what length they go depends on wh

Off the record, once they deployed, they stayed like that forever. No patches, no upgrades, nothing. The party line was "It works this way, and has worked this way, we'll keep doing it this way." That was regardless of the fact that machines got exploited. If it didn't come in on the install CD, they didn't want it. Some days I'd just sit down and cry.

There are a few OpenSource email clients that do a decent job. Evolution works as well as Outlook, and Thunderbird + Lightning trumps Live/Windows Mail. Where OpenSource falters, is they don't have a solution that works better, or equal to Exchange and costs less. There are open-source Exchange-like servers, but are generally hindered in some way for the open-source version, or require a closed-source plugin to be really effective with Outlook, and/or other exchange clients. Usually this licensing winds

Just another enterprise company that Symantec will acquire, make a half-hearted attempt to integrate it into their company, then systematically lay off all the workers, outsource product development to India, release a nearly completely nonfunctional successor to it, and eventually cancel it outright after the support contract revenue dries up. I've seen this worthless company pull this stunt too many times to expect anything different.

Note to CEOs: getting acquired by Symantec is corporate suicide. If you care at all about your employees or your product, the correct answer is not "no", but rather "hell f**king no". Just saying.

Regardless, I would assume the NSA has its fingers everywhere. Backdoors are not trivial to catch in the source code, like the famous if (uid = 0) test on an obscure flag combination on an obscure call.

Don't get me wrong, I'll trust OSS a lot more if the code can be read by anyone,but what good is the potential if no one actually does it?

The beauty is the I don't do anything the NSA cares about, I just like my privacy. Anyone powerful enough to get my personal data has bigger fish to fry.

I was trying to differentiate ability to get info on/anyone/ vs ability to get info on/everyone/ but I guess I didn't make it clear. As long as you have nothing to hide AND htey can't watch us all, life is good.

Ya, that doesn't quite make sense. An RPG survives until it hits the target. While I like explosions as much as any pyromaniac, they aren't designed to be long lived items unless you never use them. What fun is a box full of RPGs when you don't use it?

As most of the powers in WWII figured out, the most efficient means of getting rid of a pesky sniper involves an excessive use of explosive directed in the general direction of the sniper. That said, those RPGs can come in very handy.;)

This really sucks. In dial-up days, I used a cool, lightweight firewall application published by WRQ [wikipedia.org] called AtGuard [cryogenius.com]. Symantec licensed the product and incorporated it into their own software; the stand-alone product known as AtGuard then disappeared from the market. I used to use Partition Magic [wikipedia.org]. Again, Symantec bought it and it exists no more.

With that little bit of sample history, I'm sure we can bid PGP farewell.

I've kept a copy of the installer for the freeware version of PGP before they started getting uppity about it.Works on XP just great. Version 8.0.2.... dunno if this version is still found in the wild....

Well, it was already dead. Although we loved PGP at the time because it was encryption when no one was allowed to have it, the product itself was very badly designed. The user interface was hostile (Trust? Invalid? Implicit? WTF?), and although they provided E-mail plugs for Eudora and Outlook they never supplied one for Mozilla/Thunderbird. You had to copy paste th